Always-on VPN on Android Blocks Internet: How to Restore Connectivity in 2026

When Always-on VPN and "Block connections without VPN" are enabled on Android, your phone may look perfectly fine, yet the internet suddenly disappears: the browser won't load sites, Telegram hangs, YouTube can't load thumbnails, and the VPN keeps reconnecting endlessly. This article walks you through a safe diagnostic order: how to tell a protective kill switch from a broken VPN, what to check in Wi‑Fi/LTE, Private DNS and the app profile, and when it's better not to touch the settings manually.

The article is written for an informational intent: no shady workarounds, no bypassing of corporate policies, and no instructions for misuse. The goal is to restore legitimate access to your own services without losing privacy where the VPN really matters.

What's happening: a bug, a protection, or a settings conflict

Android has a system-level Always-on VPN feature: the system tries to keep the chosen VPN running permanently. Google's official documentation specifically notes that if an always-on connection stops, Android displays a persistent notification until it reconnects or the mode is turned off. The additional "Block connections without VPN" option is stricter: if the tunnel isn't up, regular traffic must not flow directly.

This is useful when avoiding leaks matters more than opening a site at any cost. But in everyday use, this logic looks like "the phone is broken": Wi‑Fi is connected, mobile data is there, the VPN icon blinks or disappears, and apps show "no internet." OpenVPN's documentation states plainly that with the blocking option enabled, internet access is paused until the VPN is restored. On user forums there is a typical scenario: after a reboot, a network change, or a server switch, the client gets stuck in a state like "Waiting for usable network" because the lockdown prevents it from rebuilding the route properly.

Important: not every such case is the fault of your ISP or a specific VPN server. In 2026, this is compounded by DNS restrictions, DPI filtering, unstable mobile networks, aggressive battery saving, and conflicts with Private DNS. That's why correct diagnostics goes from simple to complex.

Who will find this checklist most useful

This guide is for you if:

• Android shows a "Disconnected from always-on VPN" notification or similar;
• The internet drops only when "Block connections without VPN" is enabled;
• The VPN used to connect, but stopped working after a phone reboot;
• It doesn't work on Wi‑Fi but sometimes revives on LTE, or vice versa;
• Telegram, YouTube, Discord, the browser, and banking apps all behave differently;
• You don't want to disable protection permanently but need to understand where the failure is.

If the problem affects only one app — for example, a bank or a specific site won't open — it helps to compare with related articles: banks and government services don't work with VPN and VPN is connected but there's no internet. And if the VPN keeps dropping in the background, see the dedicated guide VPN on Android disconnects itself.

Quick diagnostic table

Action plan: from safe to radical

1. Capture the baseline state

Don't start by uninstalling the app. First write down three facts: which network is active, which VPN client is selected in the system settings, and whether "Block connections without VPN" is enabled. On most Android devices, the path is similar: Settings → Network & internet → VPN → gear icon next to the app. Names may differ on Samsung, Xiaomi, Pixel and other skins, so search for the word "VPN" in settings.

Check whether Android shows a persistent notification about an always-on VPN failure. If it does, the system is being honest with you: the internet is blocked because the chosen VPN didn't come up. That's not the same as "VPN connected, but the server is slow."

2. Restore the tunnel without permanently disabling protection

The safest everyday trick: temporarily turn off only "Block connections without VPN," open the VPN app, wait for the "Connected" status, and then re-enable the block. This sequence is also found in user reports about deadlock scenarios: once the connection is up, re-enabling the block usually doesn't break the active tunnel.

Don't leave the mode disabled "just in case" if you originally enabled it as a kill switch. The idea is to give the client a short window to start, not to replace a protected mode with a regular direct connection.

3. Switch the network type

If the VPN is stuck on Wi‑Fi, turn off Wi‑Fi and try mobile data. If it's stuck on LTE, turn on Wi‑Fi. When the network changes, Android rebuilds routes and the VPN client gets a fresh chance to bring up the tunnel. In practice, this helps with conflicts after the phone wakes up, a router reboot, an access point change, or a handover between cells.

On public Wi‑Fi, first make sure the network doesn't require a login page. A captive portal often won't open while a hard VPN lockdown or Private DNS is enabled. In this case, the safe order is: connect to Wi‑Fi, open the authorization page, log in, then enable the VPN. Don't enter important passwords on questionable networks before turning on a protected connection.

4. Check Private DNS

Private DNS on Android can be useful, but combined with a VPN it sometimes adds an extra point of failure. If a custom DNS host is specified and the network blocks DNS-over-TLS or the DNS server itself is unavailable, the phone may show a Wi‑Fi connection without real access to websites. We covered a similar conflict in detail in Private DNS interferes with VPN.

For diagnostics, temporarily set Private DNS to "Automatic" or "Off," reconnect to the network, and turn the VPN back on. If everything works, the problem isn't necessarily the VPN server: the combination "network + private DNS + lockdown" may simply fail at that specific point.

5. Disable aggressive battery saving for the VPN client

Always-on VPN won't help if the system kills the app in the background. Open the battery settings for the VPN client and allow it to run without harsh restrictions. This is especially relevant for firmware that unloads apps to save battery. If the VPN regularly crashes after the screen turns off, and then lockdown blocks all internet, the user sees not a "leak" but a chain: the system stopped the client → the tunnel disappeared → Android blocked direct traffic.

6. Check the profile and server

If the issue appeared after switching servers, renewing a subscription, or importing a new profile, make sure the client has a working profile selected. Check that the subscription is active, the server list has loaded, and the app doesn't require a re-login. For FoliVPN, start at the service's main page: https://folivpn.org/, then refresh the subscription in the app following your client's instructions.

Don't change protocol, DNS, server, battery settings, and the system VPN lockdown all at once: you won't know what helped. Change one parameter at a time and record the result.

Safe 7-minute checklist

1. Open the system VPN settings and check which client is selected for Always-on.
2. Check whether "Block connections without VPN" is enabled.
3. Temporarily turn off the block, but don't open sensitive sites.
4. Launch the VPN app manually and wait for a stable connection.
5. Re-enable "Block connections without VPN."
6. If that didn't help, toggle Wi‑Fi/LTE and reconnect.
7. Temporarily switch Private DNS to automatic mode.
8. Allow the VPN client to run in the background without strict battery saving.
9. Refresh your subscription profile or pick a different server.
10. If the failure repeats on every network, save screenshots and contact support.

How to tell that the blocking is work